I am running a home server ubuntu 22 and k3s running alongside cilium as kube-proxy replacement and loadbalancer
I have various apps running and recently I have setup docker-mailserver but I am having hard time getting the real client-ip

The problem is that i get the client ip as 127.0.0.6
for instance https://echo.jimytar.com is an echo service and as you can see it shows

client_address=127.0.0.6

the mailserver also does show rip 127.0.0.6

 Login: user=<[email protected]>, method=PLAIN, rip=127.0.0.6, lip=10.0.0.51, mpid=10701, TLS, session=<QfjwW6YX34l/AAAG>

I have instaled cilium using helm and currently it is running the following configuration

k8sServiceHost: ${local.k8s["ServiceHost"]}
k8sServicePort: ${local.k8s["ServicePort"]}

kubeProxyReplacement: true

routingMode: native
autoDirectNodeRoutes: true
ipv4NativeRoutingCIDR: "10.0.0.0/8"

loadBalancer:
  mode: hybrid

l2announcements:
  enabled: true

operator:
  replicas: 1
  rollOutPods: true

rollOutCiliumPods: true

KVStore:                 Ok   Disabled
Kubernetes:              Ok   1.29 (v1.29.3+k3s1) [linux/amd64]
Kubernetes APIs:         ["EndpointSliceOrEndpoint", "cilium/v2::CiliumClusterwideNetworkPolicy", "cilium/v2::CiliumEndpoint", "cilium/v2::CiliumNetworkPolicy", "cilium/v2::CiliumNode", "cilium/v2alpha1::CiliumCIDRGroup", "core/v1::Namespace", "core/v1::Pods", "core/v1::Service", "networking.k8s.io/v1::NetworkPolicy"]
KubeProxyReplacement:    True   [enp4s0   192.168.1.10 fe80::da5e:d3ff:fe12:4f7b (Direct Routing)]
Host firewall:           Disabled
SRv6:                    Disabled
CNI Chaining:            none
Cilium:                  Ok   1.15.4 (v1.15.4-9b3f9a8c)
NodeMonitor:             Listening for events on 128 CPUs with 64x4096 of shared memory
Cilium health daemon:    Ok   
IPAM:                    IPv4: 62/254 allocated from 10.0.0.0/24, 
IPv4 BIG TCP:            Disabled
IPv6 BIG TCP:            Disabled
BandwidthManager:        Disabled
Host Routing:            Legacy
Masquerading:            IPTables [IPv4: Enabled, IPv6: Disabled]
Controller Status:       381/381 healthy
Proxy Status:            OK, ip 10.0.0.93, 0 redirects active on ports 10000-20000, Envoy: embedded
Global Identity Range:   min 256, max 65535
Hubble:                  Ok              Current/Max Flows: 4095/4095 (100.00%), Flows/s: 251.19   Metrics: Disabled
Encryption:              Disabled        
Cluster health:          1/1 reachable   (2024-05-04T20:10:15Z)
Modules Health:          Stopped(0) Degraded(0) OK(11) Unknown(3)

what am I missing

for instance the echo.jimytar.com is exposed using ISTIO Ingress
I do get the correct client in the X-Forwarded-For but not as the clinet address.

I have also tried with externalTrafficPolicy: Local and still no luck

Any advise would be appreciated.

I have also tried with externalTrafficPolicy: Local and still no luck